- Set up Google Authenticator
- Signing in with a code
- Back up your codes: the setting that matters most
- Save the backup codes each site gives you
- Moving to a new phone
- When a code doesn't work
- Is Google Authenticator the best choice?
- Using it on more than one device
- Accounts to protect first
- My verdict
- Frequently asked questions
To use Google Authenticator, install the app, then turn on two-step verification in the account you want to protect and choose an authenticator app. Scan the QR code it shows with the app's plus button, and type the six-digit code to confirm. From then on, open the app for a fresh code whenever you sign in.
Google Authenticator adds a second lock to your accounts. After your password, the site asks for a six-digit code that changes every few seconds and only exists on your phone, so a stolen password on its own isn't enough to get in. It works with Google, Microsoft, Facebook, Amazon and most other services, not just Google. Here's how to set it up and the one setting that decides whether you can recover your codes if you lose your phone.
Set up Google Authenticator
- Install Google Authenticator from the App Store or Google Play.
- Open it and choose whether to sign in with your Google Account. This is the setting that backs up your codes.
- On the website you want to protect, go to its security settings and turn on two-step verification, two-factor authentication or 2FA.
- Choose authenticator app as the method. The site shows a QR code.
- In Google Authenticator, tap the plus button, then Scan a QR code, and point your camera at the screen.
- Type the six-digit code the app shows into the website to confirm.
No camera handy, or setting up on the same phone? Choose Enter a setup key instead and type or paste the key the website gives you.
Signing in with a code
- Sign in to the website with your password as usual.
- When it asks for a code, open Google Authenticator.
- Find the account and type the six digits shown.
- If the code is about to change, wait for the next one so it doesn't expire as you type.
Back up your codes: the setting that matters most
Google says that when you're signed in to your Google Account in the app, your codes sync, so signing in on a new phone brings them back. If you use the app without signing in, the codes live only on that phone. Lose or reset the phone and you're locked out of every account that uses it, unless you saved backup codes. For most people, signing in is the safer choice.
Save the backup codes each site gives you
Most websites show a list of one-time backup codes when you turn on two-step verification. Print them or store them in a password manager, not as a screenshot on the same phone. They're your way back in if your phone is lost, and they take a minute to save. Each one works only once, so cross them off as you use them.
Moving to a new phone
If you're signed in, install the app on the new phone and sign in to the same Google Account. If you're not, Google's route is to export from the old phone: open the menu, choose Transfer accounts, then Export accounts, select them and tap Next. On the new phone, choose Transfer accounts, then Import accounts, and scan the QR code. If you have many accounts, the old phone may show more than one QR code. Don't wipe the old phone until every account works on the new one.
When a code doesn't work
| Problem | Fix |
|---|---|
| Code rejected | Check the time on your phone is set automatically; codes depend on the clock |
| Wrong account | Rename accounts in the app so you can tell them apart |
| Lost phone | Use backup codes or the site's recovery process |
| New phone shows no codes | Sign in to the same Google Account, or transfer from the old phone |
Is Google Authenticator the best choice?
It's simple and widely supported, which is why it's popular. Some people prefer an authenticator inside their password manager, so passwords and codes live together. Others want codes kept apart from passwords on purpose. Either is far safer than text-message codes. My roundup of the best authenticator apps compares the alternatives, and my review of whether Bitwarden is safe covers one password manager with codes built in.
Using it on more than one device
If you sign in to Google Authenticator with your Google Account on a phone and a tablet, your codes sync to both, which is handy if you sometimes leave your phone in another room. The same codes work on each device. Just remember that anyone who can open the app on either device can see your codes, so keep a screen lock on both and don't install it on a device you share.
Accounts to protect first
- Your main email, because it can reset every other password.
- Banking and anything that holds card details.
- Your website, social media and business tools.
- Your Apple, Google or Microsoft account.
My verdict
Install Google Authenticator, sign in with your Google Account so your codes are backed up, and add your email first, then your bank and business accounts. Save each site's backup codes somewhere other than your phone. It's a few minutes' work that stops a leaked password turning into a lost account.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Frequently asked questions
How do I set up Google Authenticator?
Turn on two-step verification on a website, choose authenticator app, and scan the QR code with the app's plus button.
Does Google Authenticator back up my codes?
Yes, if you sign in to your Google Account in the app.
What happens if I lose my phone with Google Authenticator?
Sign in on a new phone if you synced, or use each site's backup codes.
Why is my Google Authenticator code not working?
Check your phone's time is set automatically, and that you picked the right account.
Can I use Google Authenticator for non-Google accounts?
Yes. It works with most sites that offer authenticator apps.
How do I move Google Authenticator to a new phone?
Sign in to the same Google Account, or use Transfer accounts to export and import.
